TianoCore EDK II CVE-2026-97631

The target host must be actively PXE-booting over IPv4 or IPv6 - the vulnerable receive request for ICMP error messages is only open during that boot window, which bounds the exposure. The attacker must deliver a unicast ICMP error message addressed to the client's IP (reachable from any network distance) that exceeds the fixed 504-byte Mode.IcmpError field; the copy loop fails to restrict length and advances the destination by cumulative rather than per-fragment length, writing attacker bytes past the field. No authentication and no user interaction are required (PR:N/UI:N). Limiting factors: the deterministic outcome without further conditions is memory corruption and a DXE-core CPU exception (boot hang / denial of OS provisioning); escalation to arbitrary code execution additionally requires the attacker to know the exact target firmware build to plant a valid counterfeit event, and the attack is only possible during PXE boot (not against a running OS).

This is a genuine high-priority issue, consistent with the vuln.today 'act_now' decision label. The vendor (TianoCore) GHSA advisory confirms an unauthenticated, pre-boot, network-reachable memory-corruption flaw in the EDK II PXE Base Code driver that executes in the DXE phase at ring 0, before Secure Boot or measured boot validates anything - so the technical impact ceiling is maximal (the CVSS 4.0 vector reports VC/VI/VA:H and subsequent-system SC/SI/SA:H, score 9.5). Signals partly conflict and several are simply absent: no EPSS score and no KEV entry are provided, and the input contains no 'POC/Exploit: Publicly available' marker - only the vendor advisory reference - so there is no public exploit identified at time of analysis and no confirmed active exploitation. The AT:P (attack requirement present) metric and the advisory's own text constrain realistic exploitation to the window while a host is actively PXE-booting, and reliable code execution additionally requires the attacker to know the exact target firmware build; these factors argue for targeted rather than opportunistic/wormable exploitation despite the critical score. The most important caveat is a patch-status conflict in the evidence: the advisory lists fix PR #13302 yet also states 'fixed in: Not patched currently,' meaning no released fixed version exists yet - verify remediation status directly with TianoCore before relying on a patch.

While a server or workstation is PXE-booting over IPv4 or IPv6, an unauthenticated attacker on a reachable network sends a unicast ICMP error message larger than 504 bytes addressed to the client's IP. The oversized message overflows the fixed 504-byte Mode.IcmpError field in the driver's private context; an attacker who knows the target firmware build can place a counterfeit event in the same packet so CoreSignalEvent() dispatches attacker-supplied bytes in the DXE phase, otherwise the host deterministically crashes/hangs (denial of OS provisioning). No public working exploit code is identified at time of analysis, though the vendor advisory describes the mechanism in detail.